Trust & security

1. How data flows

• Interviews. Employees speak or type to Sara, our AI interviewer. Voice audio goes to our voice provider to run the conversation and produce a transcript. Text and transcripts are sent to AI language models to ask follow-up questions and to write the role profile, procedures and process map.
• Uploaded SOPs. Documents an organization uploads to its portfolio are stored in a private storage bucket that browsers cannot read directly, and are read by AI models to extract processes.
• Analysis. Findings across interviews and documents are generated by AI models and stored in the customer’s workspace.
• Where it is stored. Interview data and documents are stored in our database and storage provider, Supabase, in the Asia-Pacific (Singapore) region.

2. Service providers

These providers process data on our behalf. The list matches our privacy policy.

• Supabase — database, authentication and file storage. Region: Singapore.
• Vercel — application hosting. Region: not pinned to one location; may be the United States or elsewhere.
• ElevenLabs — voice conversation and speech transcription. Region: United States or European Union.
• OpenRouter and Anthropic — AI language models for text interviews, document generation and analysis. Region: United States.
• Resend — invitation and service emails. Region: United States.

We do not use advertising or analytics trackers. We will update this list when providers change.

3. Encryption and retention

• Data is encrypted in transit.
• Uploaded SOP documents, and the access tokens for any connected document source, are encrypted by Prism before storage using AES-256-GCM, with a separate key per object. Each object is bound to its organization, so it cannot be read back as another organization’s data.
• Organizations choose how long uploaded documents are kept: keep them, delete them after a set number of days (the default is 90), or process them and discard the original straight away.
• Admins can delete individual interviews, which removes the transcript and generated documents. Closing a workspace deletes its data. See the privacy policy for details.

4. Isolation, access and audit

• Each organization’s data is scoped to its own workspace. Server code looks up the organization from the signed-in session, never from the request, and asking for another organization’s record returns “not found”. Database tables also have row-level security enabled.
• Access is role-based: organization admins, analysts, viewers and, for business units, unit viewers, contributors, approvers and owners. A role cannot be granted more than its base level allows.
• Changes to commercial and access configuration are written to an append-only audit log. Entries are hash-chained per organization, and the database refuses edits and deletes, so tampering is detectable.
• Prism staff access is limited to what is needed to run the service.

5. Employees: consent, review and confidentiality

• Before the first question, employees see a consent screen. We store the time and the version of the wording they agreed to.
• Before documents are shared, employees can review a summary of their interview, correct it and withhold items.
• Reports shared with viewers have employee names replaced with pseudonyms, in the figures and in free text.
• An employee can add “off the record” notes. These are rewritten to remove identifying detail and stored with no link to a person.

Confidential mode. A campaign, or the whole workspace by default, can be set to confidential. Admins then see only combined results: small groups are suppressed (five people by default, never fewer than three), individual interviews, PDFs and recordings stay closed unless the employee chooses to share them, and nobody can approve an interview on the employee’s behalf. Pseudonyms in confidential campaigns use a random alias, and a job title held by too few people is replaced by “Employee”.

Limits. Confidential mode is opt-in. In a standard (attributed) campaign, workspace admins can still see interview transcripts with names attached; anonymity there applies to reports shared with others. An admin can approve an interview on an employee’s behalf, but only with a recorded reason, and the action is logged. In every campaign, a job title held by too few people is shown as “Employee” in shared reports so that a unique title does not identify a person.

6. AI and your data

We do not use interview content to train AI models of our own. Prism sends data to the language-model and voice providers above to do the work you asked for. Interview findings are marked as stated by the employee or inferred, and outputs should be checked by a person.

7. Where data is processed

• Standard. Data at rest is in Singapore. Voice and AI processing happens with the providers above, which may be in the United States or European Union.
• UAE-resident. Available on request and built per engagement. It is not part of the standard service. Talk to us about what it would cover for your organization.

Today, voice and AI processing are not confined to the UAE, and we do not claim otherwise.

8. Certifications and compliance

Prism is not yet certified. ISO 27001, then SOC 2 Type I, are on our roadmap. We have not completed an independent audit.

Prism is designed to support customers’ obligations under the UAE Personal Data Protection Law, with consent records, deletion and retention controls. That is not a statement of compliance, and customers remain responsible for their own.

9. Deletion, export and security contact

To request deletion or export of data, or to ask a security or privacy question, contact privacy@infinitebarakah.com. If you were interviewed by your employer, please contact them first, as they control your interview data. For anything else, see our contact page.

If you believe you have found a security vulnerability, please email privacy@infinitebarakah.com with the details. We do not yet run a formal disclosure programme.